CVE-2026-87815: SiYuan before v3.8.2 Path Traversal via removeRiffDeck
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.2 - Configuration
Ensure the deckID parameter used by /api/riff/removeRiffDeck is validated so path traversal sequences cannot be supplied to delete deck files outside the workspace directory (vulnerable behavior exists in SiYuan versions before v3.8.2).
SiYuan /api/riff/removeRiffDeck deckID input validation = validated (no path traversal sequences)
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SiYuan administrator can exploit the vulnerable endpoint. The attack can be performed remotely over the network and does not require user interaction.
What files can be affected?
An attacker can use path traversal in the deckID parameter to delete .deck and .cards files outside the SiYuan workspace directory. The provided information does not indicate that other file types can be deleted.
Which versions need remediation?
SiYuan versions before v3.8.2 are affected. Upgrade to v3.8.2 or later.
What permissions are required for exploitation?
The attacker needs authenticated administrator privileges in SiYuan. The vulnerability does not affect an unauthenticated attacker based on the available information.